Reply to post: Re: 13 seconds?

Spoof an Ethernet adapter on USB, and you can sniff credentials from locked laptops

Nick Ryan Silver badge

Re: 13 seconds?

AFAIK it's partly because of a dumb-as USB implementation within Windows which may in part have been caused by USB device manufacturers taking shortcuts (for cost saving reasons) and failing to provide a manner to categorically identify a USB device rather than just the class/model of the device. Categorically identifying a USB device requires that it has a unique ID programmed into it somehow but this cost that the manufacturers of volume, cheap as possible devices would rather avoid. I'm not sure whether or not this unique ID is a mandatory specification or not as it's a long time since I read the specifications and these things are probably different between device classes and USB revisions.

Windows stores the device configuration against the port that the device was connected to. Merely moving a device from one port to another triggers Windows into believing that this is an entirely new device and to install fresh drivers or configuration for it. This could have been avoided if there was a unique ID to trust and that Windows trusted this, however Microsoft chose to implement a per-port configuration model. While the per-port configuration is daft it does often help because as with anything registry based the damn configuration does get corrupted (likely due to a horrible database such as the registry not being transactional and it not being possible to apply settings atomically). In this case when a device stops working when plugged into one port you can simply move it to a different port for it to start working again as it will have fresh configuration.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon